Research Experiences for Undergraduates Seminar

Binary Code Analysis on OS Kernels: Techniques and Applications

When: Wednesday, July 15, 2015
Where: PGH 563
Time: 11:00 AM

Speaker: Dr. Zhiqiang Lin, University of Texas at Dallas

Host: Prof. Stephen Huang

Being a basic means for the understanding of program logics, binary code analysis has been used in many security applications such as malware analysis, vulnerability discovery, protocol reverse engineering, and forensic analysis. However, tons of efforts in binary code analysis have been focusing on analyzing the user level software, with significant less attention on kernel binary.

In this talk, Dr. Lin would like to talk about a line of their recent efforts of how to use dynamic binary code analysis on OS kernels to solve a unique problem in virtualization, namely the semantic gap problem. This problem exists because at the hypervisor layer, the view is too low level, and there is no semantic abstraction such as files, APIs and system calls. Therefore, hypervisor layer programmers often have to manually bridge the semantic gap while developing introspection software. Through dynamic binary code analysis, Dr. Lin will talk about how to automatically bridge the semantic gap with a number of program analysis techniques from the hypervisor layer, and demonstrate a set of new applications, such as using the native command for guest-OS introspection (e.g., listing the running processes), reconfiguration (e.g., changing an IP address), and attack recovery (e.g., kill a hidden malicious process).

Bio:

Dr. Zhiqiang Lin is an assistant professor at the University of Texas at Dallas. He received his PhD from the Department of Computer Science at Purdue University in 2011. Dr. Lin is a recipient of the NSF CAREER award, the AFOSR Young Investigator award, and a VMware faculty research award. Dr. Lin's primary research interests are systems and software security, with an emphasis of developing program analysis techniques and applying them to secure the OS kernels as well as the running software.

Faculty, students, and the general public are invited.